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Abstract 

“System Insights” is a new feature in this Preview release that introduces predictive analytics capabilities 
natively in Windows Server. These predictive capabilities run locally on each server instance, and they 
analyze Windows Server system data, such as performance counters and ETW events. System Insights 
enables IT admins to run and configure these predictive capabilities, helping IT admins turn unexpected 
emergences of the past into proactive management experiences. 


In this Preview release, System Insights focuses on capacity forecasting — predicting future resource 
usage based on historical usage data. This Windows Server Preview Validation Guide provides you the 
necessary background information along with step-by-step instructions to interact with, manage, and 
evaluate System Insights using PowerShell. 
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Overview 

“System Insights” is a new feature in this Preview release that introduces predictive analytics capabilities 
natively in Windows Server. These predictive capabilities run locally on each Server instance, and they 
analyze Windows Server system data, such as performance counters and ETW events. System Insights 
enables IT admins to run and configure these predictive capabilities, which will help provide value to IT 
Pros and IT Decision Markers in the following ways: 


- Lower OPEX by turning reactive emergencies of the past into proactive management 
experiences. 

- Help increase service uptime through advanced warning of system errors, problematic behavior, 
or failures. 

- Lower CAPEX by helping IT decision makers plan their hardware purchasing plans. 

- Offload IT Pros from repetitive manual tasks. 


In this Preview release, System Insights focuses on capacity forecasting — predicting future resource 
usage based on historical usage data. This Windows Server Preview Validation Guide provides you the 
necessary background information along with step-by-step instructions to interact with, manage, and 
evaluate System Insights using PowerShell. 


System Insights technology introduction 


Predictive capabilities 
Before proceeding further, it will be helpful to define what we mean when we say predictive capability: 


- Capability — A capability is a machine learning or statistics model that analyzes system data to 
find patterns, detect trends, or make future predictions that give administrators increased 
insight into the functioning of their deployments. 


With this in mind, we can move forward to understand how System Insights works and how IT 
administrators can interact with these capabilities. 


Completely local functionality 

System Insights has been designed to run completely locally — all of your data is collected, persisted, and 
analyzed directly on your machine. Organizations can take advantage of predictive analytics features 
without any connection to the cloud, helping IT administrators both abide by any privacy and 
compliance boundaries and also save on networking capacity. To enable this predictive functionality 
locally, Windows Server 2019 added new features and processes described below: 


First, Windows Server 2019 introduces a new, local data collection feature: System Data Archiver. This 
feature collects and stores a default set of usage data, and it minimally impacts your system 
performance and negligibly increases your storage footprint. System Data Archiver is installed by 
default, and importantly, System Insights analyzes the data collected by System Data Archiver to make 
predictions. 


Second, the predictive capabilities in System Insights require no cloud-connectivity. This is possible 
because they are either: 


1. Trained offline in the cloud, using thousands of examples, and then deployed locally. 
2. Or, they are trained completely locally. 


Determining which approach to use depends on the capability and the scenarios it targets. 


Thus, the data collection and training methodology enable Windows Server 2019 to offer completely 
local predictive capabilities. 


Management overview 
System Insights exposes a PowerShell management interface to invoke and manage the predictive 
capabilities available on System Insights: 


System Insights PowerShell 


The System Insights PowerShell interface allows IT Administrators to manage each capability 
individually, so the behavior of each capability can be catered to the specific needs of a deployment. To 
demonstrate how an administrator can manage each capability, the following diagrams show the 
lifecycle of a sample capability, which will help demonstrate the configuration opportunities available to 
IT administrators. 


1. Each capability can be enabled/disabled. All capabilities are enabled by default, and disabling a 
capability prevents that capability from being invoked. 

2. Each capability can be invoked on demand or on a periodic schedule. Administrators can create 
a variety of custom schedules for each capability. (See the “Configure custom schedules” section 
for more information.) 


3. Once a capability has finished running, it will output a prediction. The prediction output 
includes: 
a. Status — The output of a capability. All capabilities must report one of five statuses to 
describe the prediction result: 
i. OK— Everything looks good. 
ii. Warning — No immediate attention is required, but you might want to take a 
look. 

iii. Critical — Something isn’t right, and you should take a look as soon as you can. 


iv. Error—An unknown problem caused the capability to fail. 
v. None -—No prediction was made. This could be due to a lack of data or any other 
capability-specific reason for not making a prediction. 


b. Status Description — A statement that helps explain the status reported by the 
capability. All statuses are accompanied by a status description. 

c. Prediction Data —The capability can output additional, capability-specific data that is 
relevant to the prediction. This data will be serialized into a JSON file and will be easily 
accessible to admins. (See section “View prediction results” for more information.) 
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4. The prediction result will automatically be stored once a capability is invoked. System Insights 
will also store the last 30 prediction statuses and status descriptions. 


) 
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To conclude, the System Insights PowerShell management interface gives admins the ability to discover, 
manage, and individually configure each capability. Each capability can be enabled/disabled, invoked on 
demand, or triggered using a custom periodic schedule, and all results will automatically be stored. 


WS2019 capabilities 


Forecasting capabilities 


In Windows Server 2019 Preview, System Insights introduces four capabilities focused on capacity 
forecasting: 


- Volume consumption forecasting — Forecasts storage consumption for each volume. 

- Total storage consumption forecasting — Forecasts total storage consumption across all local 
drives. 

- CPU capacity forecasting — Forecasts CPU usage. 

- Network capacity forecasting — Forecasts network usage for each network adapter. 


Each capability analyzes past historical data to predict future usage, and all of the forecasting 
capabilities are designed to understand long-term trends rather than short-term behavior. Because 
these capabilities focus on long-term trends, these capabilities analyze up to a year’s worth of daily data. 
The next two sections describe the data that’s used and how far in advance the capabilities forecast. 


Forecasting data 
Each capability analyzes daily data, raising the question: 


- Howis this daily data generated? 
- Ormore specifically, how is an entire day’s worth of usage aggregated into a single point? 


To answer this, it’s important to note that each capability seeks to inform administrators when future 
usage will meaningfully exceed the available capacity — just because CPU momentarily hit 100% 
utilization, that doesn’t mean CPU usage caused meaningful performance degradation. For CPU and 
Networking, there should be sustained high usage rather than momentary spikes. For volumes and total 
storage, however, storage usage cannot exceed the available capacity, even momentarily. Thus, the 
daily data is aggregated using the following logic: 


Volume consumption forecasting Maximum daily usage 
Total storage consumption forecasting Maximum daily usage 
CPU capacity forecasting Maximum 2-hour average per day 
Networking capacity forecasting Maximum 2-hour average per day 


Prediction timelines 

Each capability forecasts a certain number of days into the future based on the number of days for 
which System Data Archiver has collected data. The following table shows the prediction behavior of 
these capabilities: 


0-5 days No prediction is made. 
6-180 days 1, * number of days inputted 
180-365 days 60 days 


Prediction statuses 
Each forecasting capability uses the following statuses to describe the prediction: 


- OK: The forecast does not exceed the available capacity. 

- Warning: The forecast exceeds the available capacity in the next 30 days. 

- Critical: The forecast exceeds the available capacity in the next 7 days. 

- Error: The capability ran into an unexpected error. 

- None: There isn’t enough data to make a prediction. This could be due to a lack of data or 
because no data has been reported recently. 


Initial set-up 


Instructions 
1. Configure a Windows Server computer that runs that latest Windows Server TAP or Insider 
release. 
a. Important: If you are upgrading your OS from a previous TAP or Insider build, make sure 
you use In-Place Upgrade. 
2. Install the System-Insights feature. If you are using: 
a. Server Manager: Make sure you confirm that you’d like to add the management 
component as well. 
b. PowerShell: Use the following cmdlet: 
i. Add-WindowsFeature System-Insights -IncludeManagementTools 
c. Windows Admin Center: Install two features: System-Insights and RSAT-System- 
Insights. 
3. Runthe Get-InsightsCapability cmdlet. 
a. If the feature has been successfully installed, this cmdlet should enumerate the four 
capacity forecasting capabilities listed above. 
b. Note: Invoking a capability immediately after clean installing a new build will return an 
error. This is a known issue, and normal behavior will be restored after a couple hours. 


Important set-up “dos and don'ts” 

1. Make sure you are using In-Place Upgrade when installing new builds. If you don’t, all of the 

past data that has been collected will be deleted. 
a. If you have trouble using In-Place upgrade or hit any bugs, please let us know, and we'll 
try and get it resolved as soon as possible. (See FAQ for how to provide feedback.) 

2. Do not disable the System Data Archiver feature. System Data Archiver is enabled by default, 
and System Insights depends on the data collection functionality of System Data Archiver to 
make predictions. 


Invoke a capability 

Invoking a capability immediately runs a capability to retrieve a prediction. Running a capability can be 
an expensive operation, so it is recommended to schedule predictions during machine downtime. The 
performance impact of each forecasting model, however, is relatively modest compared to other 
machine learning models. 


Instructions 
1. Invoke a capability using the Invoke-InsightsCapability cmdlet. Note the time that you 
invoked the model. 
a. E.g. Invoke-InsightsCapability -Name “CPU capacity forecasting” 
2. PowerShell will return once the capability has finished running, and it should take only a couple 
seconds to complete. The output is accessible using the Get-InsightsCapability cmdlet. 
a. Using the Get-InsightsCapability cmdlet, confirm that the most recent output is 
visible. Ensure that the Last Run field matches the time that you invoked the capability. 


Successful outcomes 
You should now be able to invoke a capability on-demand, understand the performance impact of 
invoking a capability, and view the result using Get-InsightsCapability. 


Enable/disable capabilities 

Disabling a capability prevents that capability from being invoked. All capabilities are enabled by default, 
and you can see if a capability is enabled or disabled using the Get-InsightsCapability cmdlet. The 
default output of this cmdlet has a State parameter, which indicates whether each capability is enabled 
or disabled. 


Instructions 
1. Disable a capability using the Disable-InsightsCapability cmdlet. 
a. E.g.Disable-InsightsCapability -Name “Total storage consumption 
forecasting” 
2. Confirm the capability is disabled using the State field in the output of the Get - 
InsightsCapability cmdlet. 
3. Invoke the disabled capability using the Invoke-InsightsCapability cmdlet. 
a. E.g. Invoke-InsightsCapability -Name “Total storage consumption 
forecasting” 
b. This should fail since disabled capabilities can’t be invoked. 
4. Enable the same capability that you had previously disabled, using the Enable- 
InsightsCapability cmdlet. 
a. E.g. Enable-InsightsCapability -Name “Total storage consumption 
forecasting” 
5. Confirm that the capability is enabled using the Get-InsightsCapability cmdlet. 
6. Invoke the capability using the Invoke-InsightsCapability cmdlet. 


a. E.g. Invoke-InsightsCapability -Name “Total storage consumption 
forecasting” 
7. Confirm that the capability was invoked using the Get-InsightsCapability. 


Successful outcome(s) 
You should now be able to enable/disable capabilities, determine whether a capability is 
enabled/disabled, and understand the consequences of disabling a capability. 


Configure custom schedules 

In addition to on-demand predictions, you can also schedule periodic predictions for each capability. 
Periodic predictions are enabled by default, and the default periodic schedule invokes each capability 
every day at 3am. 


Note: You can configure schedules for both enabled and disabled capabilities. 


Instructions 


View capability schedules 
1. Use the Get-InsightsCapabilitySchedule to see the schedule that’s set for each capability. 


2. Confirm that these schedules are enabled by checking the Periodic Predictions field. 
3. Confirm that the schedules reflect the default schedule for each capability: every day at 3am. 


Create a custom schedule 
1. The Set-InsightsCapabilitySchedule cmdlet enables you to configure a variety of different 
schedules. We’ve provided some examples below, but you’re encouraged to create other 
custom schedules to make sure that the PowerShell interface suites your scheduling needs. 
a. Once every weekday at 4pm: Set-InsightsCapabilitySchedule -Name “CPU 


capacity forecasting” -Daily -DaysOfWeek Monday, Tuesday, Wednesday, 
Thursday, Friday -At 4pm 

b. Every other hour: Set-InsightsCapabilitySchedule -Name “Volume consumption 
forecasting” -Hourly -HoursInterval 2 

c. Once every three days: Set-InsightsCapabilitySchedule -Name “Network 
capacity forecasting” -Daily -DaysInterval 3 

2. Confirm that the schedule you created is visible in the Get-InsightsCapabilitySchedule 
cmdlet. 


Disable periodic predictions 
1. Periodic predictions can be disabled using the -DisableScheduledPredictions parameter: 
a. E.g. Set-InsightsCapabilitySchedule -Name “CPU capacity forecasting” - 
DisableScheduledPredictions 
2. Note: In the first TAP or Insider release, any capability that has had its schedule disabled will not 
show up in the Get-InsightsCapabilitySchedule output. Confirm that you disabled 
scheduled predictions for that capability using the Get-InsightsCapabilitySchedule. That 
capability should be missing from the output of the cmdlet: 
a. E.g.Get-InsightsCapability | Get-InsightsCapabilitySchedule 
3. You can re-enable periodic predictions at any time using the Set - 
InsightsCapabilitySchedule cmdlet. 


Restore to default schedule 
1. Use the -DefaultSchedule parameter to restore the default schedule for a capability. 
a. E.g. Set-InsightsCapabilitySchedule -Name “CPU capacity forecasting” - 
DefaultSchedule 
2. Confirm that the default schedule has been restored using the Get- 
InsightsCapabilitySchedule cmdlet. 


Successful outcomes 
You should be able to disable periodic predictions, configure custom schedules, and restore the default 
schedule for each capability. 
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View prediction results 
Instructions 


View all capability results 
1. In addition to Get-InsightsCapability, you can view the most recent capability results using 
the Get-InsightsCapabilityResult cmdlet. Note: If a capability hasn’t been invoked you, it 
won't show up in Get-InsightsCapabilityResult. 
a. E.g.Get-InsightsCapability | Get-InsightsCapabilityResult 


View the past predictions 
1. The Get-InsightsCapabilityResult cmdlet also allows you to see past prediction results 
using the History parameter. 
a. E.g.Get-InsightsCapabilityResult -Name “CPU capacity forecasting” - 
History 
2. Use the Invoke-InsightsCapability cmdlet to invoke a capability again. Confirm that all 
recent predictions are visible using the History parameter. 
a. E.g.Get-InsightsCapabilityResult -Name “CPU capacity forecasting” - 
History 


Understand the prediction data series output 

The Get-InsightsCapabilityResult cmdlet also has some additional information to help you locate 
the raw prediction data. This data will be visible graphically in Windows Admin Center, but the raw data 
will also be available in a JSON file. 


1. Use the Get-InsightsCapabilityResult cmdlet to find the location of the raw prediction 
data: 

a. Get-InsightsCapabilityResult -Name “Networking capacity forecasting” | 
fl* 

2. Use the Output field to find the path to your data. 

a. It should look like: “C:\ProgramData\Microsoft\Windows\SystemInsights\Networking 
capacity forecasting xXXxxXXXXXXXXXXXXXXX.jSON” 

3. The structure of the JSON object is pasted below, and you can use PowerShell to parse the 
output. This is demonstrated below, using the Volume consumption forecasting capability as an 
example: 

a. Extract the contents of the JSON file and save it to a variable: 
i. $out = Get-Content (Get-InsightsCapabilityResult -Name "Volume 
consumption forecasting").Output | ConvertFrom-Json 
b. View the prediction results for all volumes: 
i. Sout.PredictionResults 
c. View the past historical data of the first volume: 
i. g$out.PredictionResults[@].ObservationSeries 
d. View the prediction that was made for the first volume: 
i. gout.PredictionResults[@].Prediction 
4. Here is the structure and description of each field in the JSON output. 
a. Status — top level status 
b. Status Description — top level status description 
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c. 


Known issues 

If you have clean installed a new Windows Server 2019 Preview build, invoking the capabilities 
returns an error immediately after installation. This issue only persists for a few hours right after 
installing the new build. After a few hours, normal behavior should be restored. 


oO 


Prediction Results — array containing prediction data. For Volume and Networking 
forecasting, this will have an entry for each volume or network adapter. For Total 
Storage and CPU, this will only contain one instance. 
i. Identifier: The GUID of the instance. Note that this field is present for all 
capabilities, but it is only applicable to volumes and network adapters. 
ii. Identifier Friendly Name: The friendly name of the instance. 
iii. Status: The status for the instance. 
iv. Status Description: The status description for the instance. 
v. Limit: The upper limit for that instance, i.e. the volume size. 
vi. Observation Series: An array of historical data that’s inputted into the 
forecasting capability 
1. DateTime: The date the data point was recorded. 
2. Value: The observed value, i.e. used size of the volume. 
a. For Volume consumption forecasting and Total storage 
consumption forecasting this value will be reported in bytes. 
b. For CPU capacity forecasting this value will be reported in 
percent. 
c. For Networking capacity forecasting this value will be reported 
in bytes/second. 
vii. Prediction: An array of predictions based on the historical data in the 
Observation Series. 
1. DateTime: The date of the predicted data point. 
2. Value: The value predicted. 
a. For Volume consumption forecasting and Total storage 
consumption forecasting this value will be reported in bytes. 
b. For CPU capacity forecasting this value will be reported in 
percent. 
c. For Networking capacity forecasting this value will be reported 
in bytes/second. 


Successful outcome(s) 
You should be able view the most recent prediction results, see the past prediction results, and 
locate/parse the output data serialized in JSON. 


Frequently asked questions 
Where is System Insights available? 


System Insights is available on all stand-alone Windows Server instances. It’s available 
on Standard and Datacenter SKUs, and it runs on any hypervisor and on any cloud. 
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- Will System Insights have a GUI? 


o Yes, System Insights will integrate with Windows Admin Center. This will be available for 


preview soon. 


- Is my data being sent anywhere? 

oO For System Insights to function correctly, none of your data needs to leave your 
machine. It’s both collected and analyzed locally, without any need for a network 
connection. 

o Wedo, however, collect daily telemetry to improve System Insights in the future. This 
Windows Server build collects some basic usage telemetry data on System Insights, 
similar to other features, and it can be disabled at any time by optionally disabling 
telemetry. 


- How should | give any feedback? 


o Please send an email to system-insights-feed@microsoft.com with any feedback. 


- How expensive is it to invoke a capability? 
o These initial capabilities aren’t expensive to run — they should complete in just a few 


seconds. 
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